Merge branch 'master' into staging-client

psiphon/common/inproxy/portmapper.go

@@ -147,12 +147,24 @@ func newPortMapper(
 var portmapperDependencyVersionCheck bool
 
 func init() {
+	expectedDependencyVersion := "v1.58.2"
+
+	// portmapper.Version is a temporary vendor patch, in the dependency, to
+	// accomodate GOPATH builds which cannot use debug.ReadBuildInfo, and go
+	// tests, before Go 1.24, which don't get dependency info in the returned
+	// BuildInfo.
+	//
+	// TODO: replace temporary patch with full fork of portmapper, and remove
+	// this temporary case, if not the entire dependency version check
+	// (see "TODO: fork" in cloneProbe).
+	portmapperDependencyVersionCheck = portmapper.Version == expectedDependencyVersion
+
 	buildInfo, ok := debug.ReadBuildInfo()
 	if !ok {
 		return
 	}
 	for _, dep := range buildInfo.Deps {
-		if dep.Path == "tailscale.com" && dep.Version == "v1.58.2" {
+		if dep.Path == "tailscale.com" && dep.Version == expectedDependencyVersion {
 			portmapperDependencyVersionCheck = true
 			return
 		}
@@ -166,7 +178,7 @@ func (p *portMapper) cloneProbe(probe *PortMappingProbe) error {
 	// The required portmapper.Client fields are not exported by
 	// tailscale/net/portmapper, so unsafe reflection is used to copy the
 	// values. A simple portmapper.Client struct copy can't be performed as
-	// the struct contain a sync.Mutex field.
+	// the struct contains a sync.Mutex field.
 	//
 	// The following is assumed, based on the pinned dependency version:
 	//

psiphon/exchange.go

@@ -74,6 +74,28 @@ import (
 // The return value is a payload that may be exchanged with another client;
 // when "", the export failed and a diagnostic notice has been logged.
 func ExportExchangePayload(config *Config) string {
+
+	// Handle in-proxy limitations. The outer client should not call exchange
+	// in these cases in the first place, but these checks ensure we don't
+	// export invalid payloads.
+	//
+	// If running in proxy-only mode, no payload is exported, since there is
+	// not necessarily any recently successful server entry.
+	//
+	// If running in personal pairing tunnel, no payload is exported, since
+	// the receiving outer client needs to be aware of and configure personal
+	// pairing mode, but the payload is currently opaque to the outer client.
+	if config.DisableTunnels {
+		NoticeWarning(
+			"ExportExchangePayload skipped due to DisableTunnels")
+		return ""
+	}
+	if config.networkIDGetter.config.IsInproxyClientPersonalPairingMode() {
+		NoticeWarning(
+			"ExportExchangePayload skipped due to IsInproxyClientPersonalPairingMode")
+		return ""
+	}
+
 	payload, err := exportExchangePayload(config)
 	if err != nil {
 		NoticeWarning("ExportExchangePayload failed: %s", errors.Trace(err))